Privacy Policy

Last Updated: March 23, 2026 · Effective Date: March 23, 2026

      Your privacy is important to us. This Privacy Policy explains how StudyBuddy ("the App", "we", "us", "the Developer") collects, uses, discloses, and safeguards your information when you use the StudyBuddy mobile application. Please read this Privacy Policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.
    

1. Introduction

StudyBuddy is a mobile quiz application that allows students to photograph textbook pages and receive AI-generated interactive quizzes. This Privacy Policy applies to all users of the App, including quiz creators and recipients who access shared quiz links.

We are committed to protecting your privacy and handling your data responsibly. We collect only the minimum information necessary to provide and improve our service, and we automatically delete most data within 7 days.

2. Information We Collect and How We Use It

We collect the following types of information:

Data Type	Purpose	Retention
Camera Photos of Textbook Pages	Uploaded and processed by AI to generate interactive quizzes. Images are sent to our cloud infrastructure for processing.	Automatically deleted after 7 days
Quiz Answers and Scores	Stored to provide score tracking, reinforcement learning for wrong answers, and quiz results for shared quizzes.	Automatically deleted after 7 days
Player Names	Display names entered by shared quiz link recipients before starting a quiz. Used to identify participants in shared quiz results.	Deleted with associated quiz data (7 days)
RevenueCat User ID	Used for identity management and subscription management. This is an anonymous identifier that does not contain personally identifiable information.	Retained as long as your subscription or account is active
Device Identifiers	Collected by the RevenueCat SDK for subscription management, fraud prevention, and analytics.	Managed by RevenueCat per their privacy policy

Information We Do NOT Collect

We do not collect email addresses, phone numbers, or physical addresses.
We do not collect precise geolocation data.
We do not collect biometric data.
We do not collect contacts, calendar data, or browsing history.
We do not use advertising trackers or advertising identifiers.
We do not collect government-issued identification numbers.

3. Third-Party Services

We use the following third-party services to operate the App. Each service may collect and process data as described below:

Amazon Web Services (AWS)

We use AWS Lambda, S3, DynamoDB, CloudFront, and API Gateway for data processing, storage, and content delivery. Textbook photos are stored in AWS S3 and automatically deleted after 7 days. Quiz data is stored in AWS DynamoDB and automatically deleted after 7 days. AWS processes data on our behalf and in accordance with our instructions.

AWS Privacy Policy: https://aws.amazon.com/privacy/

Anthropic (Claude API)

We use the Anthropic Claude API for AI-powered quiz generation. When you photograph a textbook page, the image is sent to Anthropic's API for processing. Anthropic processes this data to generate quiz questions and answers. According to Anthropic's API terms, data sent through the API is not used to train their models.

Anthropic Privacy Policy: https://www.anthropic.com/privacy

RevenueCat

We use RevenueCat for subscription management and user identity. RevenueCat collects device identifiers and purchase data to manage your subscription status. RevenueCat acts as a data processor on our behalf.

RevenueCat Privacy Policy: https://www.revenuecat.com/privacy/

Apple App Store / Google Play Store

The App is distributed through the Apple App Store and Google Play Store. These platforms process payments for subscriptions and may collect additional data in accordance with their own privacy policies. We do not have access to your payment card information; all payment processing is handled directly by Apple or Google.

Apple Privacy Policy: https://www.apple.com/privacy/
Google Privacy Policy: https://policies.google.com/privacy

We use these third-party services solely for the purposes described above and do not share your personal data with any other third-party service providers, advertisers, or data brokers.

4. How We Use Your Information

We use the information we collect for the following purposes:

Provide the Service: To process textbook photos, generate quizzes, track scores, and deliver shared quiz experiences.
Manage Subscriptions: To verify your subscription status, manage free trial usage, and process subscription renewals through RevenueCat and the app stores.
Improve the Service: To analyze usage patterns (in aggregate, non-personally identifiable form) to improve quiz quality and app performance.
Ensure Security: To detect and prevent fraud, abuse, and unauthorized access to the App.
Legal Compliance: To comply with applicable laws, regulations, and legal processes.

5. Data Sharing and Disclosure

We do not sell your personal data. We do not rent, trade, or otherwise make available your personal data to third parties for their marketing purposes.

We may disclose your information only in the following circumstances:

Service Providers: We share data with the third-party service providers listed in Section 3, solely for the purpose of operating and improving the App.
Shared Quizzes: When you access a shared quiz link, the display name you enter will be visible to the quiz creator and other participants in the quiz results.
Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
Protection of Rights: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our Terms, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation in which we are involved.
Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you via the App or email before your data becomes subject to a different privacy policy.

6. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS/SSL protocols.
Encryption of data at rest in AWS S3 and DynamoDB.
Access controls limiting data access to authorized services and personnel only.
Automatic deletion of quiz data and uploaded images after 7 days.
Secure API communication using AWS API Gateway with authentication.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security. You acknowledge and accept this inherent risk when using the App.

7. Data Retention

7-Day Automatic Deletion: We retain quiz data (including uploaded textbook photos, quiz answers, scores, and associated player names) for a maximum of 7 days, after which it is automatically and permanently deleted from our systems. This is a core privacy feature of StudyBuddy.

Specific retention periods:

Textbook photos: Uploaded to AWS S3 and automatically deleted after 7 days. Photos are processed by AI and are not stored permanently.
Quiz answers and scores: Stored in AWS DynamoDB and automatically deleted after 7 days.
Player names (shared quizzes): Deleted along with associated quiz data after 7 days.
RevenueCat user ID and device identifiers: Retained as long as your subscription or account remains active. You may request deletion by contacting us.

We may retain certain anonymized, aggregated data (which cannot identify you personally) for longer periods for analytical purposes.

8. Children's Privacy

StudyBuddy is designed for students of all ages, including children in K-12 education. We take children's privacy very seriously and comply with the Children's Online Privacy Protection Act (COPPA) and other applicable laws regarding children's privacy.

For Children Under 13

Children under 13 may use the App only with the supervision and consent of a parent or legal guardian.
We do not knowingly collect personal information from children under 13 without verifiable parental consent.
The App does not require children to provide any personal information beyond what is reasonably necessary to use the service (i.e., photographing textbook pages for quiz generation).
We do not condition a child's participation on the collection of more personal information than is reasonably necessary.
All data collected from children is subject to the same 7-day automatic deletion policy.

Parental Rights

Parents and guardians have the right to:

Review any personal information we have collected from their child.
Request deletion of their child's personal information.
Refuse to allow any further collection or use of their child's information.
Revoke consent at any time by contacting us at info@stea.cr.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete such information promptly. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at info@stea.cr.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

General Rights (All Users)

Access: You have the right to request a copy of the personal data we hold about you.
Correction: You have the right to request correction of inaccurate personal data.
Deletion: You have the right to request deletion of your personal data. Note that most quiz data is automatically deleted after 7 days.
Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
Objection: You have the right to object to certain types of data processing.

For California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our business purpose for collecting it, and the categories of third parties with whom we shared it.
Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
No Sale of Personal Information: We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising.

For European Economic Area (EEA) Residents (GDPR)

If you are located in the EEA, you may have additional rights under the General Data Protection Regulation (GDPR), including:

Legal Basis: We process your data based on your consent (by using the App) and our legitimate interests in providing and improving the service.
Right to Restrict Processing: You may request that we restrict the processing of your personal data under certain conditions.
Right to Withdraw Consent: You may withdraw your consent to data processing at any time by ceasing to use the App and contacting us to delete your data.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence.
International Transfers: Your data is processed in the United States by AWS and Anthropic. We rely on the service providers' compliance with applicable data transfer mechanisms.

To exercise any of these rights, please contact us at info@stea.cr. We will respond to your request within 30 days.

10. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside, including the United States where our primary infrastructure (AWS) is located. These countries may have data protection laws that are different from the laws of your country.

By using the App, you consent to the transfer of your information to the United States and other countries where our service providers operate. We take steps to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it.

11. Do Not Track Signals

The App does not track users across third-party websites or services and therefore does not respond to Do Not Track (DNT) signals. We do not use advertising trackers, behavioral advertising, or cross-site tracking technologies.

12. Third-Party Links

The App may contain links to third-party websites or services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services. We strongly advise you to review the privacy policy of every site you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy within the App and updating the "Last Updated" date at the top of this page. Changes are effective immediately upon posting.

For material changes that significantly affect how we handle your personal data, we will make reasonable efforts to provide notice through the App before the changes take effect.

You are advised to review this Privacy Policy periodically for any changes. Your continued use of the App after the posting of changes constitutes your acceptance of such changes.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: info@stea.cr

We will make every effort to respond to your inquiry within 30 days.